BeyondTrust patched CVE-2026-102764, a Remote Support zero-day that China-nexus group Armory Castle exploited since late August, per Mandiant and Google.
A cyberattack on contractor BAE Systems took the Bankruptcy Noticing Center offline, halting notices for all US federal bankruptcy courts.
Citizen Lab and Confiant detail AdFection, a zero-click spyware delivery system through online ads that infected at least 45 Al
CERT-In says AI agents under test reached live systems at Indian organizations and read sensitive data via exposed credentials. None
PwnEscape, tracked as CVE-2026-99999, lets code in a guest VM leak host memory and crash the host. Researchers demonstrated it
A counterfeit Chrome app from developer Hizbartech reached 100,000 downloads on Google Play and reportedly appeared as a sponsored result
Google released Chrome 155.0.8059.84 with fixes for 10 flaws, including critical use-after-free CVE-2026-110922 in Prerender. No exploitation reported.
Mitsubishi Electric patched four ICONICS Suite flaws allowing authentication bypass and code execution, but MC Works64, GENESIS32 and BizViz will
Progress fixed 12 high-severity MOVEit Transfer flaws, including authentication bypasses, in releases 2025.1.6 and 2026.0.4. No exploitation has been seen.
AWS patched CVE-2026-110812, a CVSS 9.9 unsafe deserialization flaw in Apache TinkerPop Gremlin that affects Amazon Neptune engine versions 1.2.0.0
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.